GitHub Security Advisory (GHSA-qvq9-hq6p-v378)Vendor advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qvq9-hq6p-v378 CVE-2026-72803
MEDIUM
SiYuan before v3.7.4 Information Disclosure via getBlockAttrs
Record summary
CVE-2026-72803 has a selected CVSS score of 6.9 (medium).
Description
SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 12, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unaffected | CVE List | Before 3.7.4 | affected |
| 3.7.4 | unaffected |
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-72803 VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getBlockAttrsThird-party advisory
https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getblockattrs